Hardware: Dynamic VLAN registration and OSA Network Traffic Analyzer

VLANosaenta.ppt of 24

b̂usiness on demand software

© 2007 IBM Corporation

®

IBM eServer™

Hardware: Dynamic VLAN registration and OSA Network Traffic Analyzer


© 2007 IBM CorporationHardware: Dynamic VLAN registration and OSA Network Traffic Analyzer2

Agenda - System z hardware exploitation

1 Dynamic VLAN registration (late z/OS ® V1R7 item)

2 OSA-Express2 network traffic analyzer



Dynamic VLAN registration (late z/OS V1R7 item)



Dynamic VLAN registration - GVRP - simplifies VLAN administration

�OSA has recently added support for dynamic VLAN reg istration protocolsƒBoth the OSA microcode and the switch to which the OSA port is connected must support dynamic VLAN registrationƒThe protocol is referred to as GARP (Generic Attribute Registration Protocol) VLAN Registration Protocol (GVRP)ƒSimplifies management of VLAN environments

�New TCP/IP profile keywords on the IPv4 LINK statem ent and the IPv6 INTERFACE statement for QDIO netwo rk interfaces are used to control if TCP/IP should req uest dynamic VLAN registration or not

ƒDefault is to not use dynamic VLAN registration

LINK .... NODYNVLANREG/DYNVLANREG

INTERFACE .... NODYNVLANREG/DYNVLANREG

�New fields on a netstat devlinks report will indica te if the dynamic VLAN registration is supported by the OSA port and if dynamic VLAN registration is co nfigured for the link or interface

�CS z/OS V1R7 APAR PK05337 ƒPTFs UK06129 and UK06130

�Part of base CS z/OS V1R8

DYNVLANREG | NODYNVLANREGThis parameter controls whether or not the VLAN ID for this link is dynamically or statically registered with the physical switch on the LAN. Restriction: This parameter is only applicable if a VLAN ID is specified on the statement. If no VLAN ID is specified then this parameter is ignored. Dynamic registration of VLAN IDs is handled by the OSA feature and the physical switch on your LAN. Therefore, both must be at a level which provides the necessary hardware support for dynamic VLAN ID registration, in order for the DYNVLANREG parameter to be effective.



OSA-Express2 network traffic analyzer

Note: This function depends on OSA-E2 hardware and LIC updates that are not yet generally

available as of September 2006.



�Diagnosing OSA-Express QDIO problems can be very di fficultƒTCP/IP stack (CTRACE or packet trace or both)ƒVTAM (VIT)ƒOSA (hardware trace)ƒNetwork (sniffer trace)

�Often not clear where the problem is and which traces to collect

�Offloaded functions and shared OSAs can complicate the diagnosis

�Improve serviceability with an OSA-Express Network Traffic Analyzer (OSAENTA) function

ƒSupported on coming OSA-Express2 level (in QDIO mode) on System z9™–Also requires new coming level of the OSA-Express2 LIC

ƒAllows z/OS Communications Server to collect Ethernet data frames from the OSA adapter–Not a sniffer trace (but similar in some aspects)–No promiscuous mode

ƒMinimizes the need to collect and coordinate multiple traces for diagnosisƒMinimizes the need for traces from the OSA Hardware Management Console (HMC)

z/VM®, Linux®, z/VSE™,z/TPF

z/OSVTAM

TCPIPA TCPIPB TCPIPC TCPIPD

OSA-E2

Sniffer

Router/Switch

LAN

HMC Hardware Trace

VIT

CTRACE

Packet Trace

Diagnosing QDIO traffic-related problems

Which trace should I use?



OSA Express2 network traffic analyzer overview�Provide TCP/IP commands to enable an OSA Express Ne twork Traffic Analyzer

(OSAENTA) function ƒNew VARY TCPIP,,OSAENTA command ƒNew OSAENTA TCP/IP profile statement

�Provide filters to OSA to identify which data to ca ptureƒLLC type, IP addresses, port, and so on.

�Let OSA capture the data using the LAN analyzer tra ce collection functions�Transmit the captured trace data to TCP/IP�TCP/IP will then save the trace data and provide to ols that format the data using existing

TCP/IP CTRACE facilitiesƒTrace data for packets to/from all LPARs that share the adapter is availableƒIf the adapter is configured in promiscuous mode, packets on the LAN may be included too

OSA LAN traffic analyzer captures packets as close as possible to the point of transmission to or receipt from the LAN.

ƒFunctions similar to sniffer products, such as Ethereal

Hardware requirements are System z9 with OSA-Express2 port configured in QDIO Mode.

CTRACE Data

LPAR 1 LPAR 2 LPAR 3 LPAR 4

z/OS z/OS z/OSz/VM

Guest 1 Guest 2 Guest 3

System z Hypervisor (PRSM)

OSA E2 with OSA LAN Analyzer

LAN media

System z LAN sniffer

System z resident hardware LAN

sniffer to enable LAN problem

determination on the platform.



�Controlled by z/OS Communications ServerƒNew OSAENTA MVS™ console command and TCP/IP profile statement:

–Define trace filters and parameters–OSA sends trace records to the z/OS stack

ƒSave and format the data using existing Ctrace facilities

�Collected by OSA and handed up to a z/OS TCP/IP sta ckƒAbility to see:

–ARP packets–MAC headers (including VLAN tags)–Packets to/from other stacks shared by the OSA (which could be z/VM or z/Linux)–SNA packets - limited to:

�Enterprise Extender data when OSA configured in QDIO layer 3 mode�Data to/from Communication Controller for Linux (CCL) on System z when OSA configured in QDIO layer 2 mode

ƒThe OSA collects the data when it is sent across the PCI to the physical port (sometimes referred to as the NIC).ƒThe OSA also collects data for LPAR-LPAR packets which do not go onto the LAN.ƒOSA supports only one stack sharing the OSA to perform NTA tracing.ƒOne stack can perform NTA tracing for multiple OSAs.

OSA-E2

TCPIPA TCPIPB TCPIPC

NTA

IPv4/IPv6 IPv4/IPv6 IPv4/IPv6

One stack doing both normal traffic and NTA -Separate QDIO data device for NTA

OSA-E2

TCPIPA TCPIPB TCPIPC

NTA

IPv4/IPv6 IPv4/IPv6

Dedicated stack for NTA -Separate QDIO data device for NTA

Usage scenarios



OSAENTA trace filters

�Filter types (in hierarchical order)ƒDevice ID ƒMAC addressƒVLAN IDƒEthernet frame typeƒIP address (or range)ƒIP protocolƒTCP/UDP port

�Up to eight values per filter type

�Up to eight IPv4 and eight IPv6 address specificati ons

�Filters are cumulative across multiple OSAENTA comm ands

�Filter matchingƒPacket must pass all filter types to be tracedƒPacket passes a specific filter type if either:

–Packet matches on any filter value in effect for that type–No filter values are in effect for that type

ƒPacket passes if filter matches on either source or destination



OSAENTA trace interface and security�Trace interface is created automatically on first O SAENTA command for a given PORTNAME xxxxxxxx

ƒAppears as a TCP/IP interfaceƒOnly used for inbound trace dataƒInterface name EZANTAxxxxxxxx

–Name may occur in various error messages–Can be displayed using netstat devlinks

ƒNo home IP address

�The interface is started with the ON parameter of O SAENTAƒRequires an available data device from the TRLE definition

�The interface is stopped with the OFF parameter of OSAENTA ƒAlso stopped automatically if a trace limit is reached (TIME, DATA, RECORD)

�OSA NTA function is secured through Hardware Manage ment Console (HMC) authorizationƒSet the OSA NTA trace authorization in the Support Element (SE) to:

–Logical Partition (default) - can only trace packets for this operating system image–CHPID - can trace packets to/from all stacks sharing the OSA–Disabled - cannot trace any packets

ƒThese SE panels are password protected and require SE access administrator mode to enable which users can access the panels

�The V TCPIP,,OSAENTA command is secured through com mand authorizationƒNeed access to the MVS.VARY.TCPIP.OSAENTA resource in the OPERCMDS facility



OSA Express2 network traffic analyzer�Differences between packet trace and OSA network tr affic analyzer trace:

ƒPKTTRACE can collect only data for a single TCPIP stack. OSAENTA can collect data for other stacks sharing the OSA. ƒPKTTRACE data collection starts immediately. OSAENTA data collection is not started until the ON parameter is used.ƒEach PKTTRACE command/statement is one set of filters. OSAENTA filters accumulate across multiple OSAENTA commands/statements.

�Example of TCP/IP profile statements (similar synta x for a VARY TCPIP,,OSAENTA command):

OSAENTA PORTNAME=OSA5 ABBREV=1024 TIME=5 VLANID=192 IP=9.37.124/24

OSAENTA PORTNAME=OSA5 IP=9.37.125/24

OSAENTA PORTNAME=OSA5 VLANID=193 IP=9.37.126/24

OSAENTA ON PORTNAME=OSA5 RECORD=20000

�When OSAENTA is defined, a special TCP/IP network i nterface will dynamically be created:ƒEZANTA....

�This interface can be included in a netstat devlink s report and will show details of current OSA netwo rk traffic analyzer settings

�RestrictionsƒOnly one Network Traffic Analyzer per OSAƒNeed HMC authorization to see packets for other operating system imagesƒNo MAC headers for LPAR-LPAR trafficƒThe following are not traced by this function:

–Data to/from an OSA-Express2 adapter configured in Network Control Program mode (OSN channel type) –Data sent/received over the control devices

�IP Assist�OSA-Express direct SNMP subagent packets



OSA-E2

z/OS Console

TCPIPTCPIPDS1

(SYSTCPOT)

CTRACE Writer

IPCS CTRACE

Ethereal

CTRACE Data set

Sniffer Data set

1

2

3

4

5 6

7

8

9

10

11

TRACE CT,WTRSTART=

TRACE CT,WTRSTOP=

OSAENTA Command

IP Assist

Trace records

NTA functional overview and trace flows

1 Operator starts the external writer2 Operator issues OSAENTA command to start the Networ k Traffic Analyzer3 Stack activates the NTA trace data device and sends filters and parameters to

OSA using IP Assist 4 OSA sends trace packets to the stack over the NTA t race data device5 Stack copies trace packets into the SYSTCPOT compon ent trace buffer (a new

CTRACE component for this purpose)6 Ctrace writer copies the component trace buffer int o a Ctrace data set7 Operator stops the external writer8 IPCS reads the Ctrace data set9 IPCS formats the trace data to produce IPCS reports• IPCS optionally formats the trace data into a Sniff er data set• Ethereal is optionally used to process the Sniffer data set



z/OS CTRACE details

�SYSTCPOTƒA new Ctrace component for collecting NTA trace data

�CTINTA00ƒOnly SYS1.PARMLIB member for SYSTCPOTƒSpecify the default buffer sizeƒMinimum - 1M, Default - 64M, Maximum - 624MƒConnect to a CTRACE writerƒThere are no OPTIONS values

�TRACE CT,ON,COMP=SYSTCPOT,SUB=(tcpipprocname)ƒStarts the component trace

�New with z/OS V1R7, the Ctrace writer supports usin g a VSAM linear data set for fast writing of Ctrace data

ƒAllocate a VSAM linear data setƒUsed in the Ctrace writer procedureƒCan be read by the IPCS CTRACE subcommandƒCannot be sent to IBM service - Use the IPCS COPYTRC subcommand to convert it to sequential fileƒCan be used by any Ctrace component



N O T E S

Notes on using a VSAM linear data set

�Allocate a VSAM linear data set

Sample VSAM Linear data set allocation

//DEFINE EXEC PGM=IDCAMS //SYSPRINT DD SYSOUT=* //SYSIN DD * DELETE +

(USER41.CTRACE.LINEAR) + CLUSTER

DEFINE CLUSTER( + NAME(USER41.CTRACE.LINEAR) + LINEAR + MEGABYTES(10) + VOLUME(CPDLB0) + CONTROLINTERVALSIZE(32768) + ) + DATA( + NAME(USER41.CTRACE.DATA) + )

LISTCAT ENT(USER41.CTRACE.LINEAR) ALL

Sample Ctrace writer procedure//CTWTR PROC//IEFPROC EXEC PGM=ITTTRCWR //TRCOUT01 DD DSNAME=USER41.CTRACE.LINEAR,DISP=SHR //SYSPRINT DD SYSOUT=*

Note that the CONTROLINTERVALSIZE value must be 32768.Note that the 10M file requires 15 3390 cylinders. Since this is a VSAM file, there are no DCB parameters or SPACE parameters for the writer procedure



N O T E S

OSAENTA command/statement

�DefinitionƒPORTNAME=OSAportname - identify the OSA to traceƒMust match the PORTNAME value on the TRLE definition

�ControlƒON - start tracingƒOFF - stop tracingƒDEL - delete the trace definitionƒCLEAR - resets all trace filters

�ParametersƒABBREV= nnnnn - control the amount of trace data for each packetƒFULL - return as much data as possible for each packetƒDATA=nnnnn - Stop when this much total data collectedƒRECORD=nnnnn - Stop when this many records collectedƒTIME=nnnnn - Stop when trace active this many minutes



N O T E S

Notes on OSAENTA control

�PORTNAME - identifies the OSA portƒFirst instance of a port name defines the OSAENTA trace interfaceƒSubsequent instance of a port name updates the OSAENTA definition

�ON - start tracingƒAllocates a data device from the TRLEƒActivates the trace interface ƒSends the OSAENTA parameters and filters to the OSAƒResets the counters for the trace limits: DATA, RECORD and TIME

�OFF - stop tracingƒDeactivates the tracingƒDeallocates the data port for tracingƒTrace is also stopped if one of the limits (DATA, RECORD or TIME) is exceeded

�DEL - deleteƒRemoves the OSAENTA definition

�CLEAR - clear all trace filtersƒResets the current filters to NULLƒIf the trace is active, then clears the filters in the OSA



N O T E S

Notes on OSAENTA parameters

�ABBREV=nnnnn - control the amount of trace dataƒnnnnn a decimal value from 1 to 65535ƒThe default value is 200 bytes.ƒThe OSA may truncate the amount returned to less than this value

�FULL - return as much data as possible for each trace recordƒSame as ABBREV=65535

�DATA=nnnnn - Stop when this much data collectedƒnnnnn a decimal value from 1 to 2,147,483,647 in megabytesƒThe default value 1024 megabytes.

�RECORD=nnnnn - Stop when this many records collectedƒnnnnn a decimal value from 1 to 2,147,483,647ƒThe default value is 2,147,483,647 records

�TIME=nnnnn - Stop when trace active this many minutesƒnnnnn is the number of minutes to collect trace.ƒA value from 1 to 10080 minutes.ƒThe default value is 10080 minutes (seven days).



N O T E S

OSAENTA filters

�FiltersƒDEVICEID=hhhhhhhh - device identifierƒMAC=hhhhhhhhhhhh - MAC addressƒVLANID=ALL| nnnn - VLAN identifierƒETHType=IPV4|IPV6|ARP| hhhh - Ethernet typeƒIPaddr= IPv4_addr/num_bits|IPv6_addr/num_bits - IP address or rangeƒPROTOcol=TCP|UDP|ICMP|ICMPV6| nnn - IP protocol numberƒPORTNum=nnnnn - TCP/UDP port number

�Only one filter value of each type can be specified on a command. Use multiple commands to define multiple filter values.

�filter_type=* removes all the values for that filter type ƒFor example, PORTNum=* clears all port number filter values

�OSAENTA command for same OSA portname with new parameters or filtersƒUpdates the OSAENTA definition with new parameters ƒAdds the new filters to the current setƒIf the trace is active, stack sends the updates to OSA



N O T E S

Notes on OSAENTA Filters

�DEVICEID=hhhhhhhh - device identifierƒEight hexadecimal digits ƒThe DEVICEID is a concatenation of the following four values

–Channel subsystem ID–LPAR ID–Control Unit Logical Address–Unit Address

ƒIf the stack being traced is z/OS, then message IST2190I from the D NET,ID=trlename output displays the DEVICEID value.ƒIf stack being traced is non-z/OS, then use the OSA SE to obtain the DEVICEID value.

�MAC=hhhhhhhhhhhh - MAC addressƒTwelve hexadecimal digits

�VLANID=ALL|nnnn VLAN identifierƒDecimal number from 0 to 4094 or ALL

�ETHTYPE=IPV4|IPV6|ARP|hhhh - Ethernet typeƒFour hexadecimal digits or IPV4, IPV6 or ARP

�IPADDR=IPv4_addr/num_bits|IPv6_addr/num_bits - IP address or rangeƒan IPv4 or IPv6 address with a CIDR number: 192.168.1.0/24

�PROTOcol=TCP|UDP|ICMP|ICMPV6|nnn - protocol numberƒA decimal number for 0 to 255 or TCP, UDP, ICMP, or ICMPV6

�PORTNUM=nnnnn - port numberƒA decimal number for 1 to 66635



�These definitions

OSAENTA PORTNAME=OSAQDIO4 IPADDR=9.67.1.1 PROTO=TCP PORTNUM=21

OSAENTA PORTNAME=OSAQDIO4 IPADDR=9.67.2.0/24 PORTNUM=22 ON

�Produce these filters

IPAddr: 9.67.1.1/32 9.67.2.0/24

Protocol: TCP

Portnum: 21 22

�Example packets which will be traced

SrcIP = 9.67.1.1, Proto = TCP, DstPort = 22

DstIP = 9.67.2.9, Proto = TCP, SrcPort = 21

�Example packets which will NOT be traced

SrcIP = 9.67.1.1, Proto = UDP, DstPort = 22

DstIP = 9.67.2.8, Proto = TCP, SrcPort = 23, DstPort = 24

OSAENTA examples



�These definitions

�Produce these filters

�Example packets that will be traced

�Example packets that will NOT be traced

OSAENTA examples

OSAENTA PORTNAME=OSAQDIO4 IPADDR=9.67.1.1 PROTO=TCP PORTNUM=21OSAENTA PORTNAME=OSAQDIO4 IPADDR=9.67.2.0/24 PORTNUM=22 ON

IPAddr: 9.67.1.1/32 9.67.2.0/24Protocol: TCPPortnum: 21 22

SrcIP = 9.67.1.1, Proto = TCP, DstPort = 22DstIP = 9.67.2.9, Proto = TCP, SrcPort = 21

SrcIP = 9.67.1.1, Proto = UDP, DstPort = 22DstIP = 9.67.2.8, Proto = TCP, SrcPort = 23, DstPort = 24



�Netstat output...

OSA-Express Network Traffic Analyzer Information:

OSA PortName: HYD1G1 OSA DevStatus: Ready

OSA IntfName: EZANTAHYD1G1 OSA IntfStatus: Ready

OSA Speed: 1000 OSA Authorization: Logical Partition

OSAENTA Cumulative Trace Statistics:

DataBytesIn: 98000 FramesIn: 490

FramesLost: 0 FramesDropped: 0

OSAENTA Active Trace Statistics:

DataMegsIn: 0 RecordCount: 490

TimeActive: 2

OSAENTA Trace Settings: Status: On

DataMegsLimit: 1024 RecordLimit: 2147483647

TimeLimit: 5 Abbrev: 200

OSAENTA Trace Filters:

DeviceID: *

Mac: *

VLANid: *

ETHType: *

IPAddr: 8.1.1.0/24

Protocol: ICMP

Port: *

Netstat devlinks example - the OSAE NTA device



Things to think about

�New function - so no migration concerns

�Verify OSA microcode level (D TRLE)

�Configure required HMC authorization setting

�Need an available data device (from the TRLE) for t he NTA functionƒMay need to add an extra data device if one isn't available already

�LPAR-LPAR packets traced twice (once in each direct ion)

�Set appropriate filters to limit amount of data tra cedƒMinimize chances of traces wrappingƒReduce performance impact


© 2007 IBM Corporation

Trademarks, copyrights, and disclaimersThe following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both:

IBM MVS VTAM z/OS z/VM z/VSE z9

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.

Product data has been reviewed for accuracy as of the date of initial publication. Product data is subject to change without notice. This document could include technical inaccuracies or typographical errors. IBM may make improvements or changes in the products or programs described herein at any time without notice. Any statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Any reference to an IBM Program Product in this document is not intended to state or imply that only that program product may be used. Any functionally equivalent program, that does not infringe IBM's intellectual property rights, may be used instead.

Information is provided "AS IS" without warranty of any kind. THE INFORMATION PROVIDED IN THIS DOCUMENT IS DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IBM EXPRESSLY DISCLAIMS ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IBM shall have no responsibility to update this information. IBM products are warranted, if at all, according to the terms and conditions of the agreements (for example, IBM Customer Agreement, Statement of Limited Warranty, International Program License Agreement, etc.) under which they are provided. Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products.

IBM makes no representations or warranties, express or implied, regarding non-IBM products and services.

The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents or copyrights. Inquiries regarding patent or copyright licenses should be made, in writing, to:

IBM Director of LicensingIBM CorporationNorth Castle DriveArmonk, NY 10504-1785U.S.A.

Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. The actual throughput or performance that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput or performance improvements equivalent to the ratios stated here.

© Copyright International Business Machines Corporation 2007. All rights reserved.

Note to U.S. Government Users - Documentation related to restricted rights-Use, duplication or disclosure is subject to restrictions set forth in GSA ADP Schedule Contract and IBM Corp.

Hardware: Dynamic VLAN registration and OSA Network Traffic Analyzer24

Hardware: Dynamic VLAN registration and OSA Network Traffic Analyzer

Documents

Transcript of Hardware: Dynamic VLAN registration and OSA Network Traffic Analyzer